@pnpm/deps.compliance.sbom 1100.1.9 → 1100.2.0

package/lib/collectComponents.d.ts

@@ -2,6 +2,14 @@ import type { LockfileObject } from '@pnpm/lockfile.types';
 import type { Resolution } from '@pnpm/resolving.resolver-base';
 import type { DependenciesField, ProjectId, Registries } from '@pnpm/types';
 import type { SbomComponentType, SbomResult } from './types.js';
+export interface WorkspacePackageInfo {
+    name: string;
+    version: string;
+    license?: string;
+    description?: string;
+    author?: string;
+    repository?: string;
+}
 export interface CollectSbomComponentsOptions {
     lockfile: LockfileObject;
     rootName: string;
@@ -20,6 +28,21 @@ export interface CollectSbomComponentsOptions {
     lockfileOnly?: boolean;
     storeDir?: string;
     virtualStoreDirMaxLength?: number;
+    workspacePackages?: Record<ProjectId, WorkspacePackageInfo>;
+    resolvedWorkspaceDeps?: ReturnType<typeof resolveWorkspaceDeps>;
 }
 export declare function collectSbomComponents(opts: CollectSbomComponentsOptions): Promise<SbomResult>;
 export declare function gitDownloadUrl(resolution: Resolution): string | undefined;
+interface WorkspaceLink {
+    sourceImporterId: ProjectId;
+    targetImporterId: ProjectId;
+    depName: string;
+    devOnly: boolean;
+}
+export declare function resolveWorkspaceDeps(lockfile: LockfileObject, importerIds: ProjectId[], include?: {
+    [dependenciesField in DependenciesField]: boolean;
+}): {
+    links: WorkspaceLink[];
+    additionalImporterIds: ProjectId[];
+};
+export {};

package/lib/collectComponents.js

@@ -1,16 +1,71 @@
+import path from 'node:path';
 import { DepType, detectDepTypes } from '@pnpm/lockfile.detect-dep-types';
 import { nameVerFromPkgSnapshot, pkgSnapshotToResolution } from '@pnpm/lockfile.utils';
 import { lockfileWalkerGroupImporterSteps, } from '@pnpm/lockfile.walker';
 import { StoreIndex } from '@pnpm/store.index';
+import pLimit from 'p-limit';
 import { getPkgMetadata } from './getPkgMetadata.js';
 import { buildPurl, encodePurlName } from './purl.js';
+const IMPORTER_WALK_CONCURRENCY = 8;
 export async function collectSbomComponents(opts) {
     const depTypes = detectDepTypes(opts.lockfile);
     const importerIds = opts.includedImporterIds ?? Object.keys(opts.lockfile.importers);
-    const importerWalkers = lockfileWalkerGroupImporterSteps(opts.lockfile, importerIds, { include: opts.include });
     const componentsMap = new Map();
     const relationships = [];
     const rootPurl = `pkg:npm/${encodePurlName(opts.rootName)}@${opts.rootVersion}`;
+    const workspaceDeps = opts.resolvedWorkspaceDeps
+        ?? (opts.lockfileOnly
+            ? { links: [], additionalImporterIds: [] }
+            : resolveWorkspaceDeps(opts.lockfile, importerIds, opts.include));
+    const allImporterIds = [...importerIds, ...workspaceDeps.additionalImporterIds];
+    const importerWalkers = lockfileWalkerGroupImporterSteps(opts.lockfile, allImporterIds, { include: opts.include });
+    const importerIdSet = new Set(importerIds);
+    if (opts.workspacePackages) {
+        const workspaceDepTypes = new Map();
+        for (const dep of workspaceDeps.links) {
+            const info = opts.workspacePackages[dep.targetImporterId];
+            if (!info)
+                continue;
+            const purl = buildPurl({ name: info.name, version: info.version });
+            const current = workspaceDepTypes.get(purl);
+            if (!dep.devOnly) {
+                workspaceDepTypes.set(purl, DepType.ProdOnly);
+            }
+            else if (current === undefined) {
+                workspaceDepTypes.set(purl, DepType.DevOnly);
+            }
+        }
+        for (const dep of workspaceDeps.links) {
+            const info = opts.workspacePackages[dep.targetImporterId];
+            if (!info)
+                continue;
+            const purl = buildPurl({ name: info.name, version: info.version });
+            let parentPurl;
+            if (importerIdSet.has(dep.sourceImporterId)) {
+                parentPurl = rootPurl;
+            }
+            else {
+                const sourceInfo = opts.workspacePackages[dep.sourceImporterId];
+                parentPurl = sourceInfo
+                    ? buildPurl({ name: sourceInfo.name, version: sourceInfo.version })
+                    : rootPurl;
+            }
+            relationships.push({ from: parentPurl, to: purl });
+            if (!componentsMap.has(purl)) {
+                componentsMap.set(purl, {
+                    name: info.name,
+                    version: info.version,
+                    purl,
+                    depPath: `link:${dep.targetImporterId}`,
+                    depType: workspaceDepTypes.get(purl) ?? DepType.ProdOnly,
+                    license: info.license,
+                    description: info.description,
+                    author: info.author,
+                    repository: info.repository,
+                });
+            }
+        }
+    }
     const storeIndex = (!opts.lockfileOnly && opts.storeDir)
         ? new StoreIndex(opts.storeDir)
         : undefined;
@@ -22,9 +77,20 @@ export async function collectSbomComponents(opts) {
             virtualStoreDirMaxLength: opts.virtualStoreDirMaxLength ?? 120,
         }
         : undefined;
-    await Promise.all(importerWalkers.map(async ({ step }) => {
-        await walkStep(step, rootPurl, depTypes, componentsMap, relationships, opts, metadataOpts);
-    }));
+    const walkImporter = pLimit(IMPORTER_WALK_CONCURRENCY);
+    await Promise.all(importerWalkers.map(({ importerId, step }) => walkImporter(async () => {
+        let parentPurl = rootPurl;
+        if (!importerIdSet.has(importerId)) {
+            const info = opts.workspacePackages?.[importerId];
+            // A reachable workspace importer with no resolved package info (e.g. its
+            // manifest could not be read) is skipped entirely; walking it would
+            // misattribute its dependencies to the root component.
+            if (!info)
+                return;
+            parentPurl = buildPurl({ name: info.name, version: info.version });
+        }
+        await walkStep(step, parentPurl, depTypes, componentsMap, relationships, opts, metadataOpts);
+    })));
     storeIndex?.close();
     return {
         rootComponent: {
@@ -79,4 +145,47 @@ export function gitDownloadUrl(resolution) {
     const prefix = needsGitPlusPrefix ? 'git+' : '';
     return `${prefix}${resolution.repo}#${resolution.commit}`;
 }
+export function resolveWorkspaceDeps(lockfile, importerIds, include) {
+    const links = [];
+    const visited = new Set(importerIds);
+    const queue = [...importerIds];
+    const additionalImporterIds = [];
+    for (let head = 0; head < queue.length; head++) {
+        const importerId = queue[head];
+        const snapshot = lockfile.importers[importerId];
+        if (!snapshot)
+            continue;
+        const devDepNames = new Set(Object.keys(snapshot.devDependencies ?? {}));
+        const prodDeps = {
+            ...(include?.dependencies !== false ? snapshot.dependencies : {}),
+            ...(include?.optionalDependencies !== false ? snapshot.optionalDependencies : {}),
+        };
+        const allDeps = {
+            ...prodDeps,
+            ...(include?.devDependencies !== false ? snapshot.devDependencies : {}),
+        };
+        for (const [depName, reference] of Object.entries(allDeps)) {
+            if (!reference.startsWith('link:'))
+                continue;
+            const linkPath = reference.slice(5);
+            const targetId = path.posix.normalize(importerId === '.' ? linkPath : path.posix.join(importerId, linkPath));
+            // A crafted lockfile can point a `link:` target outside the workspace root;
+            // such importer IDs must never be followed, as they later become filesystem reads.
+            if (path.posix.isAbsolute(targetId) || targetId === '..' || targetId.startsWith('../'))
+                continue;
+            // `in` would also match inherited keys (e.g. "toString"); a crafted lockfile
+            // must not be able to enqueue importer IDs that are not actually present.
+            if (!Object.prototype.hasOwnProperty.call(lockfile.importers, targetId))
+                continue;
+            const devOnly = devDepNames.has(depName) && !(depName in prodDeps);
+            links.push({ sourceImporterId: importerId, targetImporterId: targetId, depName, devOnly });
+            if (!visited.has(targetId)) {
+                visited.add(targetId);
+                additionalImporterIds.push(targetId);
+                queue.push(targetId);
+            }
+        }
+    }
+    return { links, additionalImporterIds };
+}
 //# sourceMappingURL=collectComponents.js.map

package/lib/index.d.ts

@@ -1,4 +1,4 @@
-export { collectSbomComponents, type CollectSbomComponentsOptions, gitDownloadUrl } from './collectComponents.js';
+export { collectSbomComponents, type CollectSbomComponentsOptions, gitDownloadUrl, resolveWorkspaceDeps, type WorkspacePackageInfo } from './collectComponents.js';
 export { integrityToHashes } from './integrity.js';
 export { buildPurl, encodePurlName } from './purl.js';
 export { type CycloneDxOptions, serializeCycloneDx } from './serializeCycloneDx.js';

package/lib/index.js

@@ -1,4 +1,4 @@
-export { collectSbomComponents, gitDownloadUrl } from './collectComponents.js';
+export { collectSbomComponents, gitDownloadUrl, resolveWorkspaceDeps } from './collectComponents.js';
 export { integrityToHashes } from './integrity.js';
 export { buildPurl, encodePurlName } from './purl.js';
 export { serializeCycloneDx } from './serializeCycloneDx.js';

package/lib/serializeCycloneDx.d.ts

@@ -5,5 +5,6 @@ export interface CycloneDxOptions {
     sbomAuthors?: string[];
     sbomSupplier?: string;
     specVersion?: string;
+    compact?: boolean;
 }
 export declare function serializeCycloneDx(result: SbomResult, opts?: CycloneDxOptions): string;

package/lib/serializeCycloneDx.js

@@ -1,4 +1,5 @@
 import crypto from 'node:crypto';
+import { DepType } from '@pnpm/lockfile.detect-dep-types';
 import { integrityToHashes } from './integrity.js';
 import { classifyLicense } from './license.js';
 import { encodePurlName } from './purl.js';
@@ -14,6 +15,19 @@ export function serializeCycloneDx(result, opts) {
             purl: comp.purl,
             'bom-ref': comp.purl,
         };
+        // CycloneDX `excluded` scope (valid in every exported spec version):
+        // "component usage for test and other non-runtime purposes", which is the
+        // semantics of a devDependency.
+        // Components reachable through prod (ProdOnly/DevAndProd) omit scope and
+        // default to `required`. Installed optionalDependencies are runtime-reachable,
+        // so they stay `required` too, not `optional`.
+        if (comp.depType === DepType.DevOnly) {
+            cdxComp.scope = 'excluded';
+            // Also emit the CycloneDX npm-taxonomy marker. `scope` is the modern
+            // signal; `cdx:npm:package:development` is what @cyclonedx/cyclonedx-npm
+            // emits and what older consumers read, so we provide both.
+            cdxComp.properties = [{ name: 'cdx:npm:package:development', value: 'true' }];
+        }
         if (group) {
             cdxComp.group = group;
         }
@@ -136,7 +150,7 @@ export function serializeCycloneDx(result, opts) {
         components: bomComponents,
         dependencies: bomDependencies,
     };
-    return JSON.stringify(bom, null, 2);
+    return JSON.stringify(bom, null, opts?.compact ? undefined : 2);
 }
 function splitScopedName(fullName) {
     if (fullName.startsWith('@')) {

package/lib/serializeSpdx.d.ts

@@ -1,2 +1,5 @@
 import type { SbomResult } from './types.js';
-export declare function serializeSpdx(result: SbomResult): string;
+export interface SpdxOptions {
+    compact?: boolean;
+}
+export declare function serializeSpdx(result: SbomResult, opts?: SpdxOptions): string;

package/lib/serializeSpdx.js

@@ -1,7 +1,7 @@
 import crypto from 'node:crypto';
 import { integrityToHashes } from './integrity.js';
 import { encodePurlName } from './purl.js';
-export function serializeSpdx(result) {
+export function serializeSpdx(result, opts) {
     const { rootComponent, components, relationships } = result;
     const rootSpdxId = 'SPDXRef-RootPackage';
     const documentNamespace = `https://spdx.org/spdxdocs/${sanitizeSpdxId(rootComponent.name)}-${rootComponent.version}-${crypto.randomUUID()}`;
@@ -123,7 +123,7 @@ export function serializeSpdx(result) {
         packages: [rootPackage, ...spdxPackages],
         relationships: spdxRelationships,
     };
-    return JSON.stringify(doc, null, 2);
+    return JSON.stringify(doc, null, opts?.compact ? undefined : 2);
 }
 function sanitizeSpdxId(value) {
     return value.replace(/[^a-z0-9.-]/gi, '-');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.compliance.sbom",
-  "version": "1100.1.9",
+  "version": "1100.2.0",
   "description": "Generate SBOM from pnpm lockfile",
   "keywords": [
     "pnpm",
@@ -33,16 +33,16 @@
     "@cyclonedx/cyclonedx-library": "10.1.0",
     "p-limit": "^7.3.0",
     "ssri": "13.0.1",
-    "@pnpm/deps.compliance.license-resolver": "1100.0.0",
     "@pnpm/lockfile.detect-dep-types": "1100.0.11",
-    "@pnpm/lockfile.types": "1100.0.11",
-    "@pnpm/lockfile.utils": "1100.0.13",
     "@pnpm/lockfile.walker": "1100.0.11",
-    "@pnpm/pkg-manifest.reader": "1100.0.8",
+    "@pnpm/lockfile.utils": "1100.0.13",
+    "@pnpm/deps.compliance.license-resolver": "1100.0.0",
     "@pnpm/resolving.resolver-base": "1100.4.2",
     "@pnpm/store.index": "1100.2.0",
+    "@pnpm/lockfile.types": "1100.0.11",
+    "@pnpm/types": "1101.3.2",
     "@pnpm/store.pkg-finder": "1100.0.17",
-    "@pnpm/types": "1101.3.2"
+    "@pnpm/pkg-manifest.reader": "1100.0.8"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
@@ -50,9 +50,9 @@
   "devDependencies": {
     "@jest/globals": "30.4.1",
     "@types/ssri": "^7.1.5",
-    "@pnpm/deps.compliance.sbom": "1100.1.9",
-    "@pnpm/logger": "1100.0.0",
-    "@pnpm/store.cafs": "1100.1.10"
+    "@pnpm/store.cafs": "1100.1.10",
+    "@pnpm/deps.compliance.sbom": "1100.2.0",
+    "@pnpm/logger": "1100.0.0"
   },
   "engines": {
     "node": ">=22.13"